Initial commit

init/minio-bootstrap.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# Idempotent MinIO bootstrap: bucket + per-app service account scoped to that
+# bucket. Re-running just refreshes the policy and resets the access key.
+set -eu
+
+mc alias set local http://minio:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
+
+ensure_bucket() {
+  bucket="$1"
+  if ! mc ls "local/${bucket}" >/dev/null 2>&1; then
+    mc mb "local/${bucket}"
+  fi
+  mc anonymous set none "local/${bucket}" >/dev/null
+}
+
+write_policy() {
+  name="$1"
+  bucket="$2"
+  cat > "/tmp/${name}.json" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
+      "Resource": ["arn:aws:s3:::${bucket}"]
+    },
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+      "Resource": ["arn:aws:s3:::${bucket}/*"]
+    }
+  ]
+}
+EOF
+  mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
+    || mc admin policy update local "${name}" "/tmp/${name}.json"
+}
+
+ensure_user() {
+  access="$1"
+  secret="$2"
+  policy="$3"
+  if mc admin user info local "${access}" >/dev/null 2>&1; then
+    # Rotate secret to match desired state.
+    mc admin user remove local "${access}" >/dev/null
+  fi
+  mc admin user add local "${access}" "${secret}"
+  mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
+}
+
+ensure_bucket "asxpio-invoices"
+write_policy  "asxpio-invoices-rw" "asxpio-invoices"
+ensure_user   "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
+
+echo "minio-init: done"